Hadoop Common
  1. Hadoop Common
  2. HADOOP-7189

Add ability to enable 'debug' property in JAAS configuration

    Details

    • Type: Improvement Improvement
    • Status: Resolved
    • Priority: Minor Minor
    • Resolution: Fixed
    • Affects Version/s: 0.22.0
    • Fix Version/s: 0.22.0
    • Component/s: security
    • Labels:
    • Hadoop Flags:
      Reviewed

      Description

      Occasionally users have run into weird "Unable to login" messages. Unfortunately, JAAS obscures the underlying exception message in many cases because it thinks leaking the exception might be insecure in itself. Enabling the "debug" option in the JAAS configuration gets it to dump the underlying issue and makes troubleshooting this kind of issue easier.

      1. enable-UGI-debug-example.txt
        2 kB
        Todd Lipcon
      2. HADOOP-7189.patch
        3 kB
        Andrew Whang
      3. HADOOP-7189.txt
        2 kB
        Ted Yu

        Activity

        Transition Time In Source Status Execution Times Last Executer Last Execution Date
        Open Open Patch Available Patch Available
        58d 1h 48m 1 Todd Lipcon 11/May/11 23:45
        Patch Available Patch Available Resolved Resolved
        4m 1 Todd Lipcon 11/May/11 23:49
        Hide
        Hudson added a comment -

        Integrated in Hadoop-Common-22-branch #49 (See https://builds.apache.org/hudson/job/Hadoop-Common-22-branch/49/)

        Show
        Hudson added a comment - Integrated in Hadoop-Common-22-branch #49 (See https://builds.apache.org/hudson/job/Hadoop-Common-22-branch/49/ )
        Todd Lipcon made changes -
        Fix Version/s 0.22.0 [ 12314296 ]
        Hide
        Todd Lipcon added a comment -

        Oops, sorry about the fix version. I did check the UGI tests locally before committing - sorry I didn't mention this.

        Show
        Todd Lipcon added a comment - Oops, sorry about the fix version. I did check the UGI tests locally before committing - sorry I didn't mention this.
        Hide
        Tsz Wo Nicholas Sze added a comment -

        Forgot to run tests and set fix versions?

        Show
        Tsz Wo Nicholas Sze added a comment - Forgot to run tests and set fix versions?
        Hide
        Hudson added a comment -

        Integrated in Hadoop-Common-trunk #686 (See https://builds.apache.org/hudson/job/Hadoop-Common-trunk/686/)
        HADOOP-7189. Add ability to enable debug property in JAAS configuration. Contributed by Ted Yu.

        Show
        Hudson added a comment - Integrated in Hadoop-Common-trunk #686 (See https://builds.apache.org/hudson/job/Hadoop-Common-trunk/686/ ) HADOOP-7189 . Add ability to enable debug property in JAAS configuration. Contributed by Ted Yu.
        Hide
        Hudson added a comment -

        Integrated in Hadoop-Common-trunk-Commit #593 (See https://builds.apache.org/hudson/job/Hadoop-Common-trunk-Commit/593/)
        HADOOP-7189. Add ability to enable debug property in JAAS configuration. Contributed by Ted Yu.

        Show
        Hudson added a comment - Integrated in Hadoop-Common-trunk-Commit #593 (See https://builds.apache.org/hudson/job/Hadoop-Common-trunk-Commit/593/ ) HADOOP-7189 . Add ability to enable debug property in JAAS configuration. Contributed by Ted Yu.
        Todd Lipcon made changes -
        Status Patch Available [ 10002 ] Resolved [ 5 ]
        Resolution Fixed [ 1 ]
        Hide
        Todd Lipcon added a comment -

        Committed to 22 and trunk. Thanks, Ted!

        Show
        Todd Lipcon added a comment - Committed to 22 and trunk. Thanks, Ted!
        Todd Lipcon made changes -
        Status Open [ 1 ] Patch Available [ 10002 ]
        Hadoop Flags [Reviewed]
        Affects Version/s 0.22.0 [ 12314296 ]
        Affects Version/s 0.23.0 [ 12315569 ]
        Hide
        Todd Lipcon added a comment -

        +1 for Ted's patch. Unfortunately I wasn't able to use the test that Andrew contributed, since this feature happens in a static initialization block and depends on an env var. I manually tested by running the UGI class from the command line with and without the env var set to "true".

        Show
        Todd Lipcon added a comment - +1 for Ted's patch. Unfortunately I wasn't able to use the test that Andrew contributed, since this feature happens in a static initialization block and depends on an env var. I manually tested by running the UGI class from the command line with and without the env var set to "true".
        Ted Yu made changes -
        Attachment HADOOP-7189.txt [ 12478888 ]
        Hide
        Ted Yu added a comment -

        Changed the name of environment variable according to Todd's suggestion.

        Show
        Ted Yu added a comment - Changed the name of environment variable according to Todd's suggestion.
        Ted Yu made changes -
        Attachment HADOOP-7189.txt [ 12478882 ]
        Andrew Whang made changes -
        Attachment HADOOP-7189.patch [ 12478885 ]
        Hide
        Andrew Whang added a comment -

        identical to HADOOP-7189.txt, but with test case

        Show
        Andrew Whang added a comment - identical to HADOOP-7189 .txt, but with test case
        Hide
        Todd Lipcon added a comment -

        Looks good, though I would suggest using HADOOP_JAAS_DEBUG as the environment variable. Our convention is that env vars are ALL_CAPITAL_LETTERS, reserving dot.separated.words for conf options.

        Show
        Todd Lipcon added a comment - Looks good, though I would suggest using HADOOP_JAAS_DEBUG as the environment variable. Our convention is that env vars are ALL_CAPITAL_LETTERS, reserving dot.separated.words for conf options.
        Ted Yu made changes -
        Attachment HADOOP-7189.txt [ 12478882 ]
        Hide
        Ted Yu added a comment -

        This patch is based on Todd's patch.

        Introduced an environment variable to control the addition of debug option.

        Show
        Ted Yu added a comment - This patch is based on Todd's patch. Introduced an environment variable to control the addition of debug option.
        Ted Yu made changes -
        Assignee Ted Yu [ yuzhihong@gmail.com ]
        Todd Lipcon made changes -
        Labels newbie
        Hide
        Allen Wittenauer added a comment -

        I agree. This definitely looks like something that should get reformulated so that we could set it for debugging without rebuilding and/or (even worse) restarting the service.

        Show
        Allen Wittenauer added a comment - I agree. This definitely looks like something that should get reformulated so that we could set it for debugging without rebuilding and/or (even worse) restarting the service.
        Todd Lipcon made changes -
        Field Original Value New Value
        Attachment enable-UGI-debug-example.txt [ 12473613 ]
        Hide
        Todd Lipcon added a comment -

        this isn't a patch meant to actually be committed - but just shows the debug setting I'm talking about. This should be made conditional by a Java property or env var.

        Show
        Todd Lipcon added a comment - this isn't a patch meant to actually be committed - but just shows the debug setting I'm talking about. This should be made conditional by a Java property or env var.
        Todd Lipcon created issue -

          People

          • Assignee:
            Ted Yu
            Reporter:
            Todd Lipcon
          • Votes:
            0 Vote for this issue
            Watchers:
            4 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development